Potential RegPwn EoP Vulnerability Exploit (CVE-2026-24291)

Tim Peck@timpeck

•updated Mar 15, 2026•12•0•389

Detects potential exploitation of the RegPwn privilege escalation vulnerability (CVE-2026-24291). The exploit involves creating a registry symbolic link in a user-writable accessibility configuration path that is later accessed by a SYSTEM process. This allows an attacker to write to an arbitrary registry location as SYSTEM. This rule detects the creation of the malicious registry symlink, the payload execution where osk.exe modifies a service, and the command-line arguments of the public proof-of-concept tool.